The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.
The state of the art in computer security is inefficient, partly due to an inability to integrate information between security tools that are designed to protect networks. Examples of network security tools include malware scanners and threat detectors such as FireEye, Bit9, Palo Alto Networks, and Snort, each of which is either commercially available at the time of this writing or is an available open source project.
The lack of integration usually restricts automation, because individual security tools are isolated to work within their respective silos. Manual, inefficient effort is then required to overcome the lack of integration, and the lack of integration makes it challenging to have visibility into what is happening on network. Consequently, operational teams and security teams may have to use many separate efforts to diagnose, locate and respond to malicious attacks. Therefore, administrators and security personnel are at a disadvantage when attacks occur, typically resulting in slow, disjoined responses and extensive manual effort. For example, it is not uncommon for only a few minutes to elapse from initial attack to initial compromise of an asset, but for days or weeks to pass between the time of discovering the attack and/or compromise until the attack is contained and systems are restored.
Moreover, typical security tools can detect threats well but can recommend only one particular remediation process that does not take into account the complete environment in which an attacked computer is located, the nature of its users, and/or the nature of the attacked computer itself.